Auditing of object access can make a huge amount of entries in the security
log even when you have not enabled auditing on any folders yet. One thing to
check is that in Local Security Policy [secpol.msc], or whatever appropriate
security policy, that the security option for audit:audit the access of
global system objects is disabled. I can tell you right now that keeping
track of read activities will generate a huge amount of events. When you do
audit a folder it is best to audit absolute minimum number of permissions
for absolute minimum number of users/groups and avoid auditing for everyone,
users, authenticated user groups but instead use a global/local group of
just the users you want to track. The free MS too Event Comb can help in
tracking object access events and it can search by text string such as for
filename or user name. The link below may help.   --- Steve

http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitym
onitoring/default.mspx